[º¸¾È´º½º ±è°æ¾Ö ±âÀÚ] Apache Struts¿¡¼ ¼ºñ½º °ÅºÎ °ø°ÝÀÌ °¡´ÉÇÑ Ãë¾àÁ¡À» ÇØ°áÇÑ º¸¾È ¾÷µ¥ÀÌÆ®¸¦ ¹ßÇ¥Çß´Ù. ³·Àº ¹öÀüÀ» »ç¿ë ÁßÀÎ ½Ã½ºÅÛÀº ¼ºñ½º °ÅºÎ °ø°Ý¿¡ Ãë¾àÇÒ ¼ö ÀÖ¾î ÀÌ¿ëÀÚ´Â ÃֽŠ¹öÀüÀ¸·Î ¾÷µ¥ÀÌÆ®ÇØ¾ß ÇÑ´Ù.
[À̹ÌÁö=https://cwiki.apache.org/»çÀÌÆ®]
À̹ø¿¡ ¹ß°ßµÈ Ãë¾àÁ¡Àº REST Ç÷¯±×Àο¡¼ Á¶ÀÛµÈ XMLÀ» ¿äûÇÏ¿© DoS °ø°ÝÀÌ °¡´ÉÇÑ Ãë¾àÁ¡(CVE-2018-1327)ÀÌ´Ù.
¿µÇâÀ» ¹Þ´Â Á¦Ç°Àº Struts 2.1.1 ~ 2.5.14.1 ¹öÀü »ç¿ëÀÚ·Î Struts 2.5.16 ¹öÀüÀ¸·Î ¾÷µ¥ÀÌÆ®¸¦ Àû¿ëÇØ¾ß ÇÑ´Ù. ¶ÇÇÑ, XSteam 󸮱⠴ë½Å Jackson XLM 󸮱⸦ »ç¿ëÇØ¾ß ÇÑ´Ù.
Á»´õ ÀÚ¼¼ÇÑ »çÇ×Àº Çѱ¹ÀÎÅͳÝÁøÈï¿ø ÀÎÅͳÝħÇØ´ëÀÀ¼¾ÅÍ(±¹¹ø¾øÀÌ 118)¿¡ ¹®ÀÇÇÏ¸é µÈ´Ù.
[Âü°í»çÀÌÆ®]
[1] https://cwiki.apache.org/confluence/display/WW/S2-056
[2] https://struts.apache.org/download.cgi#struts2516
[3] http://struts.apache.org/plugins/rest/#custom-contenttypehandlers
[±è°æ¾Ö ±âÀÚ(boan3@boannews.com)]
<ÀúÀÛ±ÇÀÚ: º¸¾È´º½º(www.boannews.com) ¹«´ÜÀüÀç-Àç¹èÆ÷±ÝÁö>